Why Don’t You Use Public Key Encryption To Protect Your Data Sent From the Browser?

I recently asked a software developer why they didn’t encrypt sensitive data back to the back-end application. “Well, we use https, so…

Why Don’t You Use Public Key Encryption To Protect Your Data Sent From the Browser?

I recently asked a software developer why they didn’t encrypt sensitive data back to the back-end application. “Well, we use https, so it’s okay”. “But, before we get to the tunnel, and after it, anyone and anything can read the data. How can you know it is a trusted API you are dealing with?”. “Well, it’s not my problem, it’s up to https to do that”. Unfortunately we rely too much on machine-to-machine tunnels such as with SSL/TLS. These do not protect data from a malicious proxy running on the client machine or on the server.

“Why don’t you encrypt data in the browser?”, I then said. “But it will take too long!”, “Is a few thousandths of second a long time?”, “No, but we support mobile phones, and it’s not going to work”, So I demo’ed my Samsung S9 phone encrypting and decrypting in 27 ms using 1,024-bit RSA:

So while the key pair generation is certainly a time consuming process, the actual encryption and decryption in the browser (or on the server) can be done fairly quickly, and will thus protect the data from its source to the back-end application. No other entity on the way will then be able to read the data, and only the private key would decrypt the data.

Background

If I told you my RSA public key was:

And you created a cipher message of:

ndVRez/bTbaCmx7ti/JuSJ5cfnU2kIUfzmLLee3tNr7N0TwgSjFiwj+ZwfuVOdCSDgMCabo9u1kQKwerYqLt2+/J3udGkGTCizoWhxMH89KNNe6n5VGNRrAnE5/xliHacp9vY4scNXQsHK5V+BQbVuBTuP7w6ZzwA2i6BSaXeDs=

Would you know how I would decipher it? Well, that’s the kinda thing we do on our MSc, and challenge our students to use public key encryption. The answer is, of course, to use my private to decrypt it. In this case my private key is:

And I get back “hello”.

And in the browser this time …

But you say. So can I do this is a browser? Yes. It’s quite easy. With the magic of JavaScript we can create our RSA key pair, and then encrypt and decrypt:


        function trsa(word) {
 
         var keySize =1024;
 
         var dt = new Date();
         var time = -(dt.getTime());
         var crypt = new JSEncrypt({ default_key_size: keySize });
 
         crypt.getKey();
         dt = new Date();
         time += (dt.getTime());
 
         document.getElementById("key").innerHTML="";
         document.getElementById("key").innerHTML += 'Key generated in ' + time + ' ms';
         document.getElementById("key").innerHTML += "\nPrivate key:\n" +crypt.getPrivateKey();
         document.getElementById("key").innerHTML += "\nPublic key:\n" +crypt.getPublicKey();
 
         var dt = new Date();
         var time = -(dt.getTime());
 
         var cipher = crypt.encrypt(word);
         var decipher = crypt.decrypt(cipher);
         dt = new Date();
         time += (dt.getTime());
 
         document.getElementById("hash").innerHTML="";
         document.getElementById("hash").innerHTML += 'Encrypt/decrypt in ' + time + ' ms';
         document.getElementById("hash").innerHTML += "\nText:\t" +word;
 
         document.getElementById("hash").innerHTML += "\nEncrypt with public key:\t" +cipher;
         document.getElementById("hash").innerHTML += "\nDecrypt with private key:\t"+ decipher;
 
   
     }
 
 
 </script>
     
 <script type="text/javascript" src="https://travistidwell.com/jsencrypt/bin/jsencrypt.js"></script>

I have used the Travisidwell.com JavaScript integration. You can find my demo here:

JavaScript Encryption with CryptoJS
function t1(message) { var digest = CryptoJS.MD5(message); document.getElementById("hash").innerHTML = "Type:\t\tMD5"…asecuritysite.com

In our real code, we just add our public key, and encrypt our data, and send it back to the back-end application, and which has the private key to decrypt it.

Conclusions

Go on … generate those key pairs, and get encrypting your data in the browser. OpenSSL works great for generating the key pair, and you can just pop the public key into the JavaScript of your browser, and you’ll be one step toward living in a GDPR-era.

And if you don’t like RSA, then use ECC. And, if you support devices which will struggle with RSA and ECC, you just default something more simple. And simple test can determine if the device can use public key encryption or not. While public key encryption is not use for large amounts of data, for data posted from a form, it will normally be acceptable in its operation.